On 05.07.23 04:38, Robert Senger wrote:
> Thanks for the hint that the milter is responsible for that. Found
> a
> little patch for spamass-milter that fixed this.
Am Mittwoch, dem 05.07.2023 um 10:20 +0200 schrieb Matus UHLAR -
fantomas:
note that the headers that appear first in the message are considered
trusted, while those below do not.
That's why most of milters put added headers at the beginning of
message.
On 05.07.23 14:41, Robert Senger wrote:
Hm, trusted by whom?
e.g. spamassassin uses this mechanism.
In my understanding, nothing in the headers can be
trusted at all as long as it's not covered by a digital signature (like
DKIM), or added by a machine under my own control...
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
This is it. You can trust any header before the first Received: header
added by your machine (or further Received headers added by trusted
machines), of course if you trust that machine.
all further headers, e.g. X-Spam-* headers put at the end of headers are not
trusted, even the sender can add them and trick you e.g. into thinking your mail
is not spammy, clear of viruses etc.
... however I see that spamass-milter adds headers at the end of message, so
they are not to be trusted further.
Other point: Different spam processing milters seem to add different
"Spam-X-<something>" headers.
The spamass-milter software adds
X-Spam-Checker-Version: <version information>
X-Spam-Status: <scanning results>
and, if it detects spam,
X-Spam-Flag: YES
X-Spam-Level: ***********
IIUC these headers are added by spamass-milter if spamassassin adds them.
I have these in all mails because I have configures SA to always add these.
Now, spamass-milter *replaces* any of these if they are found in the
incoming message. So, all the spam checking information added by my
backup MX is replaced by the headers of my primary MX when it receives
a message initially delivered to the backup MX, as they both use the
same spamass-milter software.
IIRC spamass-milter always removes these headers if the mail is not coming
from trusted IP address (-i option), unless you disable this.
That's the way spamass-milter makes sure that you can trust those headers
when you read the mail. Without it, they would be completely untrustable.
But it I look at a message received through this list, I see "Spam-X"
headers added by "Debian amavisd-new at spamproc1-he-fi.apache.org".
This software always adds
X-Spam-Score: <score>
X-Spam-Level: <empty>
X-Spam-Status: <scanning results>
(but no X-Spam-Checker-Version:)
to the top of the headers if the message is not classified as spam (it
would also add "X-Spam-Flag" if it detects spam, I assume). Now, my own
spamass-milter *replaces* "X-Spam-Status" at it's original position,
and *adds* "X-Spam-Checker-Version" at the bottom (or top, if patched)
of the headers. This is a mess...
Wouldn't it be better if all previous "Spam-X" headers get completely
removed?
spamass-milter only cares (in the ways described above) about a few headers:
% strings /usr/sbin/spamass-milter|grep -i x-spam
X-Spam-Flag
X-Spam-Status
X-Spam-Orig-To
X-Spam-Report
X-Spam-Prev-Content-Type
X-Spam-Level
X-Spam-Checker-Version
you need to patch spamass-milter to take those in account.
IIUC, headers replaced by milter are replaces in their place, while milter
can choose where to add new headers. Obviously spamass-milter adds them at
the end.
--
Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
M$ Win's are shit, do not use it !
